Microsoft Entra SDK for AgentID: Polyglot Agent Authentication
Containerized companion service that handles token management for AI agents over HTTP — any language, any framework.
Image: mcr.microsoft.com/entra-sdk/auth-sidecar:1.0.0-azurelinux3.0-distroless. See GitHub releases for tags.
For code patterns, deployment manifests, security hardening, and troubleshooting, see sdk-sidecar-deployment.md.
Architecture
Client App → Your Agent (Python/Node/Go/Java)
→ Microsoft Entra SDK for AgentID (localhost:5000)
→ Microsoft Entra ID
↓
Downstream APIsThe SDK runs as a companion container in the same pod or Docker network. Your agent calls it over HTTP — no SDK embedding required.
Agent Integration (3P and Custom Agents)
Third-party and custom agents authenticate using the Blueprint → BlueprintPrincipal → Agent Identity hierarchy. The SDK acquires tokens on their behalf:
GET /AuthorizationHeaderUnauthenticated/graph
?AgentIdentity={agent-app-id}
┌──────────────────┐ ┌─────────────────────────────┐
│ Agent │ ─────────▶ │ Microsoft Entra SDK for │
│ (any language) │ ◀───────── │ AgentID (:5000) │
│ │ { authorizationHeader: "Bearer eyJ..." }│
└────────┬─────────┘ └──────────────┬──────────────┘
│ Authorization: Bearer <JWT> │ OAuth 2.0
▼ ▼
┌──────────────────────┐ ┌──────────────────────────┐
│ Downstream APIs │ │ Microsoft Entra ID │
│ · Microsoft Graph │ │ · Blueprint │
│ · Custom APIs │ │ · AgentIdentity │
│ · Azure Services │ │ │
└──────────────────────┘ └──────────────────────────┘SDK Configuration
Core Settings
yaml
env:
- name: AzureAd__Instance
value: "https://login.microsoftonline.com/"
- name: AzureAd__TenantId